CVE-2022-36005: `CHECK` fail in `FakeQuantWithMinMaxVarsGradient` in TensorFlow
TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit f3cf67ac5705f4f04721d15e485e192bb319feed. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36005?
CVE-2022-36005 has been classified as a denial of service vulnerability.
How do I fix CVE-2022-36005?
To fix CVE-2022-36005, update TensorFlow to version 2.7.3 or later.
Which versions of TensorFlow are affected by CVE-2022-36005?
CVE-2022-36005 affects TensorFlow versions prior to 2.7.3 and between 2.8.0 and 2.8.1, as well as between 2.9.0 and 2.9.1.
What specific function is vulnerable in CVE-2022-36005?
The vulnerable function in CVE-2022-36005 is `tf.quantization.fake_quant_with_min_max_vars_gradient`.
Can CVE-2022-36005 lead to exploitation?
Yes, CVE-2022-36005 can lead to a denial of service attack if the input `min` or `max` is nonscalar.